Windows 11 Kernel CVE-2025-55334

Exploitation requires the attacker to already have local, authenticated access to an affected Windows 11 host (22H2, 23H2, 24H2, or 25H2) as a low-privilege user, per CVSS PR:L and AV:L - it cannot be triggered remotely or by an unauthenticated user despite the description's 'unauthorized attacker' phrasing. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The principal limiting factor is the prerequisite local foothold; impact is confined to confidentiality (C:H, I:N, A:N), meaning the flaw discloses sensitive kernel-stored data but does not by itself grant code execution, privilege escalation, or system disruption. The exact security feature bypassed and the data exposed are not specified in the available description.

This is a moderate-severity local information-disclosure flaw (CWE-312, cleartext storage of sensitive information) in the Windows 11 kernel, rated CVSS 5.5. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates an attacker must already have local, authenticated low-privilege access and can exploit it with low complexity and no user interaction, yielding high confidentiality impact but no integrity or availability impact. There is a notable conflict in the input: the NVD description calls this an 'unauthorized attacker' operating 'locally,' yet the CVSS vector specifies PR:L, which denotes an already-authenticated low-privilege user - the PR:L vector is the more precise signal and should be trusted over the loose 'unauthorized' wording; verify with Microsoft's advisory. The EPSS score is low (0.35%, 27th percentile), the CVE is not listed in CISA KEV, and no public exploit code was identified, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Overall this is a real but lower-priority issue: the local-only vector plus required prior access and absence of exploitation signals place it well below internet-facing or wormable bugs, though as a kernel security-feature bypass it remains relevant for defense-in-depth and privileged-workstation hardening. The security feature being bypassed is not named in the available data.

An attacker who has already gained a foothold on a Windows 11 host as a standard (low-privilege) user runs a crafted process that reads sensitive information the kernel stored in cleartext, bypassing a security feature intended to protect it. No user interaction is required, and exploitation is low-complexity, but it depends entirely on the attacker first obtaining local code execution. No public proof-of-concept was identified at the time of analysis.